How to add session to request (nextAuth)?

Unanswered

Orinoco Crocodile posted this in #help-forum

Orinoco CrocodileOP

2023-06-19T12:07:07.000Z

I am using Next Auth for authorization. After authorization I have session with accessKey. How can I add accessKey to protected request to the server?

import { getServerSession } from "next-auth/next"
import { authOptions } from "src/app/api/auth/[...nextauth]/route";



axios.interceptors.request.use(
  async (config) => {
        const session = await getServerSession(req, res, authOptions)

    if (session?.accessToken) {
      config.headers.authorization = `Bearer ${session?.accessToken}`
    }

    return config;
  },
  (error) => Promise.reject(error)
);

Cannot find name 'res'

53 Replies

@Orinoco Crocodile I am using Next Auth for authorization. After authorization I have session with accessKey. How can I add accessKey to protected request to the server? import { getServerSession } from "next-auth/next" import { authOptions } from "src/app/api/auth/[...nextauth]/route"; axios.interceptors.request.use( async (config) => { const session = await getServerSession(req, res, authOptions) if (session?.accessToken) { config.headers.authorization = `Bearer ${session?.accessToken}` } return config; }, (error) => Promise.reject(error) ); Cannot find name 'res'

alfon

2023-06-19T13:26:58.000Z

session are already sent via the header and cookie

getServerSession itself uses cookies and headers under the hood

axios.interceptors.request.use(
  async (config) => {
        const session = await getServerSession(req, res, authOptions)

    if (session?.accessToken) {
      config.headers.authorization = `Bearer ${session?.accessToken}`
    }

    return config;
  },
  (error) => Promise.reject(error)
);

what are you trying to do here?

@alfon ts axios.interceptors.request.use( async (config) => { const session = await getServerSession(req, res, authOptions) if (session?.accessToken) { config.headers.authorization = `Bearer ${session?.accessToken}` } return config; }, (error) => Promise.reject(error) ); what are you trying to do here?

Orinoco CrocodileOP

2023-06-19T13:33:22.000Z

Let's say I have a secure api. I need to add accessKey headers. How can I get it in the interceptor?

config.headers.authorization = `Bearer ${data?.accessKey}

like this

alfon

2023-06-19T13:33:52.000Z

is the secure api in nextjs or external server?

Orinoco CrocodileOP

2023-06-19T13:34:03.000Z

External server

alfon

2023-06-19T13:34:07.000Z

i see

Orinoco CrocodileOP

2023-06-19T13:34:24.000Z

For example get list of posts for specific user

alfon

2023-06-19T13:35:23.000Z

is your nextauth using db or jwt?

Orinoco CrocodileOP

2023-06-19T13:35:38.000Z

jwt

alfon

2023-06-19T13:36:24.000Z

i dont think there is access key with jwt :/

unless you put it there manually

Orinoco CrocodileOP

2023-06-19T13:38:31.000Z

the user logs in, the server sends me an accessKey ( jwt token ). And I put it in a session. And I have a dilemma, how to make secure requests and put accessKey in these requests so that 401 errors are not returned

alfon

2023-06-19T13:38:56.000Z

which server? external or next-auth

Orinoco CrocodileOP

2023-06-19T13:39:30.000Z

External - for example some secret information from backend

alfon

2023-06-19T13:39:55.000Z

ah so the jwt is decrypted in external server not from nextauth

Orinoco CrocodileOP

2023-06-19T13:40:40.000Z

I don't understand ðŸ˜¦

I don't need decrypte, I just need send it with some request

alfon

2023-06-19T13:41:23.000Z

how did you validate user info if you don't decrypt it?

the way jwt works is that you need to send the whole jwt in EVERY request as opposed of Bearer Token

and the server (whoever receiving client jwt) will decrypt it and validate it if user is valid or not. if valid -> authenticated

the decrypted result of JWT is a payload that contains summarized user info

@alfon how did you validate user info if you don't decrypt it?

Orinoco CrocodileOP

2023-06-19T13:42:59.000Z

Server send me name, emal and accessKey

Backend*

alfon

2023-06-19T13:43:26.000Z

hmmm in the form of JWT right? i hope not in POJO :''))

Orinoco CrocodileOP

2023-06-19T13:44:10.000Z

It is just json

alfon

2023-06-19T13:44:24.000Z

so its not jwt :/

so why can't you just access the accessKey inside the json?

if ure using jwt in NextAuth i may need to see your jwt() callback inside authOption

@alfon so its not jwt :/

Orinoco CrocodileOP

2023-06-19T13:45:10.000Z

why? it is contains accessKey

@alfon if ure using jwt in NextAuth i may need to see your jwt() callback inside authOption

Orinoco CrocodileOP

2023-06-19T13:45:23.000Z

okey one sec

alfon

2023-06-19T13:45:25.000Z

thats not what jwt is ðŸ¥¹

Orinoco CrocodileOP

2023-06-19T13:47:21.000Z

const providers = [
    CredentialsProvider({
        type: 'credentials',
        credentials: {},
        authorize: async (credentials) => {
            try {
                const { email, password } = credentials as any

                const user = await axios.post(process.env.URL)

                // const user = {
                //     data: {
                //         status: true,
                //         message: '',
                //         payload: {
                //             name: 'user',
                //             email: 'usera@mail.ru',
                //             accessKey:
                //                 'wRByOblxUkYENRm4UGBjZWKazX',
                //         },
                //     },
                // }   /// this is what server return

                if (user.data.payload.accessKey) {
                    return user.data.payload
                }
            } catch (e) {
                console.log(e)
            }
        },
    }),
]

export const authOptions: NextAuthOptions = {
    secret: process.env.NEXTAUTH_SECRET,
    session: {
        strategy: 'jwt',
        maxAge: 30 * 86400,
    },
    providers: providers,
    pages: {
        signIn: '/auth/login',
    },
    callbacks: {
        jwt: async ({ token, user, account, profile }) => {
            if (user) {
                token.accessKey = user.accessKey
            }
            return token
        },
        async signIn({ user, account, profile, email, credentials }) {
            return true 
        },

        session: async ({ session, token, user }) => {
            session.accessKey = token.accessKey
            return session
        },
    },
}

alfon

2023-06-19T13:49:15.000Z

ah its in the token

getServerSession returns a session object not the token

then the token is passed to session() callback

accessKey is already in the session

it should be in the getServerSession() already then

is it not working? any error?

@alfon is it not working? any error?

Orinoco CrocodileOP

2023-06-19T13:50:57.000Z

Not errors, but how can I add my accessKey in every protercted request?

alfon

2023-06-19T13:51:24.000Z

where did you call the request?

next.js server? browser?

Orinoco CrocodileOP

2023-06-19T13:51:41.000Z

I found this article

import axios from "axios";

import { memoizedRefreshToken } from "./refreshToken";

axios.defaults.baseURL = "http://localhost:3333/api";

axios.interceptors.request.use(
  async (config) => {
    const session = JSON.parse(localStorage.getItem("session"));

    if (session?.accessToken) {
      config.headers = {
        ...config.headers,
        authorization: `Bearer ${session?.accessToken}`,
      };
    }

    return config;
  },
  (error) => Promise.reject(error)
);

ANd in this case person doesn't use next auth, but I use

https://dev.to/franciscomendes10866/how-to-use-axios-interceptors-b7d

I need the same but with Next auth